For some reason AWS Certificate Manager suddenly wants CAA

Good

That's not an overly bad thing, it's not like your jumping cloud host anytime soon?

Edit: AWS says it's still optional.
https://docs.aws.amazon.com/en_pv/...

That wreck havoc on our CI/CD pipelines, and yes it's still optional.

In fact it's CloudFlare's fault to silently and transparently include their own CAA to their domains.

Not a lot of work to add them back, finding the cause took us some time though.